Safety systems and material testing systems including safety systems

ABSTRACT

Safety systems and material testing systems including safety systems are disclosed. An example material testing system includes: an actuator configured to control an operator-accessible component of the material testing system; an actuator disabling circuit configured to disable the actuator; and one or more processors configured to: control the actuator based on a material testing process; monitor a plurality of inputs associated with operation of the material testing system; determine, based on the plurality of inputs and the material testing process, a state of the material testing system from a plurality of predetermined states, the predetermined states comprising one or more unrestricted states and one or more restricted states; and control the actuator disabling circuit based on the determined state.

RELATED APPLICATIONS

This patent claims priority to U.S. Provisional Patent Application Ser.No. 62/773,895, filed Nov. 30, 2018, entitled “SAFETY SYSTEMS ANDMATERIAL TESTING SYSTEMS INCLUDING SAFETY SYSTEMS.” The entirety of U.S.Provisional Patent Application Ser. No. 62/773,895 is incorporatedherein by reference.

BACKGROUND

This disclosure relates generally to materials testing, and moreparticularly, to safety systems and material testing systems includingsafety systems.

Universal testing machines are used to perform mechanical testing, suchas compression strength testing or tension strength testing, onmaterials or components.

SUMMARY

Safety systems and material testing systems including safety systems aredisclosed, substantially as illustrated by and described in connectionwith at least one of the figures, as set forth more completely in theclaims.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other features, aspects, and advantages of the presentdisclosure will become better understood when the following detaileddescription is read with reference to the accompanying drawings in whichlike characters represent like parts throughout the drawings, wherein:

FIG. 1 is an example testing device to perform mechanical propertytesting, in accordance with aspects of this disclosure.

FIG. 2 is a block diagram of an example implementation of the testingdevice of FIG. 1 .

FIG. 3 is a block diagram of an example implementation of the safetysystem of FIG. 2 .

The figures are not necessarily to scale. Wherever appropriate, similaror identical reference numerals are used to refer to similar oridentical components.

DETAILED DESCRIPTION

Conventional material testing systems use mitigation techniques, such asconfiguration switches, guarding, limited force controls, motionlimiting, and/or protection, to improve operator safety. However,conventional material testing systems frequently do not always complywith international standards. Conventional mitigation techniques requirethe operator to place the system in the appropriate mode of operation,such as safe interaction or testing. Many conventional safety techniquescan be implemented using off-the-shelf safety components, such asprogrammable logic controllers (PLCs) and/or relays. PLCs and relaystypically add significant cost to the material testing system.

Disclosed example material testing systems embed or integrate a safetysystem complying with international standards within the materialtesting system. Because the safety system is integrated into thematerial testing systems, disclosed example material test systemsprovide safety improvements at a much lower cost than would beaccomplished using off-the-shelf parts because the safety system isintegrated into the existing electronics, semiconductors, and/or circuitboards of the material testing systems. Integration further improvesreliability, which reduces or eliminates external wiring betweenpurchased safety components.

As described in more detail below, disclosed example safety systems formaterial testing systems include machine state indicators that visuallyshow the state of the testing machine from an operational restrictionperspective. Disclosed example safety systems for material testingsystems provide high reliability and monitored activation mechanisms atthe machine point of control, which may include internal fault checkingand/or power supply diagnostics within the material testing systems. Insome examples, pneumatic grips are provided with two stage grip pressurecontrol and monitoring. Disclosed example material testing systems arecompatible with interlock guarding systems having redundant or diversecontacts. Such guarding systems comply with ISO safety standards byusing redundant, diverse, and/or dynamic monitoring in real time.Disclosed example material testing systems include redundant crossheadtravel limit monitoring. The material testing system shutdown circuitryof disclosed examples is compliant with international safety standardsincluding ISO 13849-1.

Additionally, conventional off-the-shelf safety relay components usedwith PLCs use an extra layer of firmware within the PLC to stop themotion of the moving components during an emergency stop event.Disclosed example safety systems for material testing systems areconfigured to enable the hardware (e.g., an emergency stop button) todirectly shutdown a power amplifier drive to the actuator(s), regardlessof whether the embedded firmware within the safety processor is running.

Disclosed example material testing systems are compliant with theEuropean Machinery Directive, following the rules set forth in the ISO13849-1 standard, which pertains to the “Safety Related Parts of ControlSystems.” The following functions, which are determined by a system riskanalysis, are integrated into the material testing system. The safetysystem provides a disabled drive state to remove energy from the drivecrosshead, a disabled drive state to remove energy from the grippingsystem, and a restricted drive state for operator setup. In therestricted drive state, the example safety systems monitor the crossheadspeed to maintain the crosshead speed below an upper speed limit,monitor for intentional manual movement (jogging) of the crosshead,monitor for reduced gripping pressure when closing, and/or monitor forintentional grip closure.

As used herein, a “crosshead” refers to a component of a materialtesting system that applies directional (axial) and/or rotational forceto a specimen. A material testing system may have one or morecrossheads, and the crosshead(s) may be located in any appropriateposition and/or orientation in the material testing system.

Disabling of circuitry, actuators, and/or other hardware may be done viahardware, software (including firmware), or a combination of hardwareand software, and may include physical disconnection, de-energization,and/or a software control that restricts commands from being implementedto activate the circuitry, actuators, and/or other hardware. Similarly,enabling of circuitry, actuators, and/or other hardware may be done viahardware, software (including firmware), or a combination of hardwareand software, using the same mechanisms used for disabling. Firmware mayinclude stored instructions such as Safety Rated Embedded Software(SRESW) and/or Safety Rated Application Software (SRASW).

The disclosed example material testing systems further include anunrestricted drive state, which enables the removal of checks in therestricted drive state. In some examples, the unrestricted drive statecan be entered via a dual activation mechanism, in which materialtesting functionality is performed and the operator does not interactwith the system.

Disclosed example material testing systems include indicators fordifferent states, such as a disabled state, a setup state (e.g.,restricted drive mode), a caution state (e.g., unrestricted drive mode),and a testing state (e.g., unrestricted drive mode) indication on everymachine to clearly indicate when the operator may interact and when ahazard is present.

Disclosed example material testing systems include one or more stopfunctions that are configured to take precedence over the startingand/or continuation of motion of components such as the crosshead orgrips. Furthermore, one or more stop functions may be redundantlyconfigured via hardware such that the stop functions are effective todisable the material testing system even when software portions of thesafety system are disabled. Examples of such stop functions that may beincluded in disclosed systems include interlocked guards and/oremergency stop switches.

Some disclosed example material testing systems include selection andenforcement of a single control point for starting the material testingframe and/or gripping system. Some example systems provide power failuremonitoring and/or protection to ensure the system stops unrestrictedoperation and places the material test system into the disabled drivestate upon re-establishment of power. In some examples, in response to apower failure, any pneumatic specimen gripping is automaticallyde-energized.

Disclosed example safety systems and material testing systems includeincreased internal diagnostics and reporting to the operator of criticalerrors within the system, such as malfunctions of equipment or conflictsbetween redundant inputs, outputs, and/or processes. Disclosed examplematerial testing systems enable faster specimen removal and/orinsertion, relative to conventional material testing systems, due to thesafe setup mode of the testing machine that permits operator activitywithin the test space without disabling of the material testing systemor requiring guard doors. Disclosed example systems further improveoperator safety when setting up and configuring the system inside thetest space, due at least in part to use of the setup state, whichrestricts motion of the crosshead and/or limited motion and/or forcethat can be exerted by the grips.

Disclosed material testing systems and safety systems may be speciallyconfigured to be utilized in the disclosed example configurations, toachieve identified risk mitigations. Disclosed material testing systemsare significantly more efficient and targeted to materials testing thanpurchasing general purpose, off-the-shelf, discrete safety components.

Disclosed example material testing systems include: an actuatorconfigured to control an operator-accessible component of the materialtesting system; an actuator disabling circuit configured to disable theactuator; and one or more processors configured to: control the actuatorbased on a material testing process; monitor a plurality of inputsassociated with operation of the material testing system; determine,based on the plurality of inputs and the material testing process, astate of the material testing system from a plurality of predeterminedstates, the predetermined states comprising one or more unrestrictedstates and one or more restricted states; and control the actuatordisabling circuit based on the determined state.

In some example material testing systems, the one or more processorsinclude a safety processor having a plurality of processing coresconfigured to: execute redundant code to monitor the plurality of inputsand to determine the state of the material testing system; and compareoutputs of the redundant code, wherein at least one of the control ofthe actuator disabling switch or control of a state output indicator isbased on the comparison of the outputs. In some examples, the pluralityof inputs includes a guarding input configured to indicate whether anoperator is within a predetermined volume around the material testingsystem, and the one or more processors are configured to set the stateof the material testing system in response to determining that theoperator is within the predetermined volume.

Some example material testing system further include at least one of amechanically interlocked guard door or a light curtain, configured tooutput the guarding input. In some examples, the one or more processorsare configured to limit a speed of the actuator in response to theguarding input.

In some examples, the operator-accessible component includes anautomatic grip or a manual grip configured to grip a material undertest, in which the actuator is configured to actuate the automatic gripor the manual grip, and further includes: a crosshead configured to movethe automatic grip or the manual grip to position the automatic grip orthe manual grip or apply force to the material under test held by theautomatic grip or the manual grip; and a second actuator configured toactuate the crosshead, wherein the one or more processors are configuredto limit at least one of the actuator or the second actuator based onthe state of the material processing system. Some example materialtesting systems further include a plurality of speed sensors configuredto monitor a speed of the crosshead, and the one or more processorsconfigured to: limit the speed of the crosshead; compare speeds detectedby the speed sensors; and, when the compared speeds have more than athreshold difference, at least one of: a) set the state of the materialtesting system or b) disable operation of the material testing system.

In some examples, the one or more processors are configured to: when thematerial testing system is in any of the one or more restricted states,limit a pressure that can be applied by the automatic grip to less thana threshold force; and when the material testing system is in one ormore of the unrestricted states, enable the actuator to exceed thethreshold force that may be applied by the automatic grip.

In some examples, the plurality of inputs include an emergency stopinput coupled to at least one of the one or more processors or theactuator disabling circuit, in which at least one of the one or moreprocessors or the emergency stop input is configured to control theactuator disabling circuit to disconnect the actuator from the source ofenergy for the actuator. In some examples, the one or more processorsare configured to control the actuator disabling circuitry to continuedisconnection of the actuator from the source of energy after theemergency stop input is released until the one or more processorsidentify a user interaction to reconnect the actuator to the source ofenergy.

Some example material testing systems further includes an actuatorbraking circuit configured to, in response to a signal to disconnect theactuator from a source of energy, decelerate the actuator prior to thedisconnection. In some examples, the one or more processors areconfigured to: determine whether the actuator is decelerating by atleast a threshold deceleration; and, in response to determining that theactuator is not decelerating by at least the threshold deceleration,disconnect the actuator.

Some example material testing systems further include a power supplymonitor circuit configured to monitor a power supply of the materialtesting system, in which the one or more processors are configured to atleast one of set the state of the material testing system or disableoperation of the material testing system in response to a signal fromthe power supply monitor circuit indicating that the power supply is outof tolerance.

In some examples, the state output indicator includes at least one of aplurality of lights corresponding to the one or more unrestricted statesand the one or more restricted states, or a display configured todisplay information about the material testing system. In some examples,the one or more processors are configured to: monitor the state outputindicator; and at least one of set the state of the material testingsystem or disable operation of the material testing system in responseto detecting that the state output indicator is not outputting a statecorresponding to the determined state.

In some examples, the one or more unrestricted states include: a cautionstate in which the one or more processors are reducing restrictions onthe actuator and are not controlling the actuator to perform testing;and a testing state in which the one or more processors are reducingrestrictions on the actuator and are controlling the actuator to performtesting. In some examples, the one or more restricted states include: asetup state in which the one or more processors are restricting theactuator and controlling the actuator in response to operator inputs;and a disabled state in which the one or more processors are restrictingthe actuator and do not control the actuator in response to operatorinputs.

In some examples, the actuator includes at least one of an electricmotor, a pneumatic actuator, a hydraulic actuator, a piezoelectricactuator, a relay, or a switch. In some examples, the one or moreprocessors include: a control processor configured to perform thecontrol of the actuator; and one or more safety processors configured toperform the monitoring of the plurality of inputs, the determining ofthe state of the material testing system, and the controlling of theactuator disabling circuit.

FIG. 1 is an example material testing system 100 to perform mechanicalproperty testing. The example material testing system 100 may be, forexample, a universal testing system capable of static mechanicaltesting. The material testing system 100 may perform, for example,compression strength testing, tension strength testing, shear strengthtesting, bend strength testing, deflection strength testing, tearingstrength testing, peel strength testing (e.g., strength of an adhesivebond), torsional strength testing, and/or any other compressive and/ortensile testing. Additionally or alternatively, the material testingsystem 100 may perform dynamic testing.

The example material testing system 100 includes a test fixture 102 anda computing device 104 communicatively coupled to the test fixture 102.The test fixture 102 applies loads to a material under test 106 andmeasures the mechanical properties of the test, such as displacement ofthe material under test 106 and/or force applied to the material undertest 106. While the example test fixture 102 is illustrated as a dualcolumn fixture, other fixtures may be used, such as single-column testfixtures.

The example computing device 104 may be used to configure the testfixture 102, control the test fixture 102, and/or receive measurementdata (e.g., transducer measurements such as force and displacement)and/or test results (e.g., peak force, break displacement, etc.) fromthe test fixture 102 for processing, display, reporting, and/or anyother desired purposes.

FIG. 2 is a block diagram of an example implementation of the materialtesting system 100 of FIG. 1 . The example material testing system 100of FIG. 2 includes the test fixture 102 and the computing device 104.The example computing device 104 may be a general-purpose computer, alaptop computer, a tablet computer, a mobile device, a server, anall-in-one computer, and/or any other type of computing device.

The example computing device 104 of FIG. 2 includes a processor 202. Theexample processor 202 may be any general purpose central processing unit(CPU) from any manufacturer. In some other examples, the processor 202may include one or more specialized processing units, such as RISCprocessors with an ARM core, graphic processing units, digital signalprocessors, and/or system-on-chips (SoC). The processor 202 executesmachine readable instructions 204 that may be stored locally at theprocessor (e.g., in an included cache or SoC), in a random access memory206 (or other volatile memory), in a read only memory 208 (or othernon-volatile memory such as FLASH memory), and/or in a mass storagedevice 210. The example mass storage device 210 may be a hard drive, asolid state storage drive, a hybrid drive, a RAID array, and/or anyother mass data storage device.

A bus 212 enables communications between the processor 202, the RAM 206,the ROM 208, the mass storage device 210, a network interface 214,and/or an input/output interface 216.

The example network interface 214 includes hardware, firmware, and/orsoftware to connect the computing device 201 to a communications network218 such as the Internet. For example, the network interface 214 mayinclude IEEE 202.X-compliant wireless and/or wired communicationshardware for transmitting and/or receiving communications.

The example I/O interface 216 of FIG. 2 includes hardware, firmware,and/or software to connect one or more input/output devices 220 to theprocessor 202 for providing input to the processor 202 and/or providingoutput from the processor 202. For example, the I/O interface 216 mayinclude a graphics processing unit for interfacing with a displaydevice, a universal serial bus port for interfacing with one or moreUSB-compliant devices, a FireWire, a field bus, and/or any other type ofinterface. The example material testing system 100 includes a displaydevice 224 (e.g., an LCD screen) coupled to the I/O interface 216. Otherexample I/O device(s) 220 may include a keyboard, a keypad, a mouse, atrackball, a pointing device, a microphone, an audio speaker, a displaydevice, an optical media drive, a multi-touch touch screen, a gesturerecognition interface, a magnetic media drive, and/or any other type ofinput and/or output device.

The example computing device 104 may access a non-transitory machinereadable medium 222 via the I/O interface 216 and/or the I/O device(s)220. Examples of the machine readable medium 222 of FIG. 2 includeoptical discs (e.g., compact discs (CDs), digital versatile/video discs(DVDs), Blu-ray discs, etc.), magnetic media (e.g., floppy disks),portable storage media (e.g., portable flash drives, secure digital (SD)cards, etc.), and/or any other type of removable and/or installedmachine readable media.

The example material testing system 100 of FIG. 1 further includes thetest fixture 102 coupled to the computing device 104. In the example ofFIG. 2 , the test fixture 102 is coupled to the computing device via theI/O interface 216, such as via a USB port, a Thunderbolt port, aFireWire (IEEE 1394) port, and/or any other type serial or parallel dataport. In some other examples, the test fixture 102 is coupled to thenetwork interface 214 and/or to the I/O interface 216 via a wired orwireless connection (e.g., Ethernet, Wi-Fi, etc.), either directly orvia the network 218.

The test fixture 102 of FIG. 2 includes a frame 228, a load cell 230, adisplacement transducer 232, a cross-member loader 234, materialfixtures 236, a control processor 238, and a safety system 240. Theframe 228 provides rigid structural support for the other components ofthe test fixture 102 that perform the test. The load cell 230 measuresforce applied to a material under test by the cross-member loader 234via the grips 236. The cross-member loader 234 applies force to thematerial under test, while the material fixtures 236 (also referred toas grips) grasp or otherwise couple the material under test to thecross-member loader 234. The example cross-member loader 234 includes amotor 242 (or other actuator) and a crosshead 244. The crosshead 244couples the material fixtures 236 to the frame 228, and the motor 242causes the crosshead to move with respect to the frame to position thematerial fixtures 236 and/or to apply force to the material under test.Example actuators that may be used to provide force and/or motion of acomponent of the material testing system 100 include electric motors,pneumatic actuators, hydraulic actuators, piezoelectric actuators,relays, and/or switches.

Example grips 236 include compression platens, jaws or other types offixtures, depending on the mechanical property being tested and/or thematerial under test. The grips 236 may be manually configured,controlled via manual input, and/or automatically controlled by thecontrol processor 238. The crosshead 244 and the grips 236 areoperator-accessible components.

The example control processor 238 communicates with the computing device104 to, for example, receive test parameters from the computing device104 and/or report measurements and/or other results to the computingdevice 104. For example, the control processor 238 may include one ormore communication or I/O interfaces to enable communication with thecomputing device 104. The control processor 238 may control thecross-member loader 234 to increase or decrease applied force, controlthe fixture(s) 236 to grasp or release a material under test, and/orreceive measurements from the displacement transducer 232, the load cell230 and/or other transducers.

The example safety system 240 provides an additional layer of monitoringand control to the test fixture 102. The safety system 240 monitorsoperator inputs and the state of the test fixture 102. In the example ofFIG. 2 , the safety system 240 restricts operation of the test fixture102 by the user so that the test fixture 102 is only controllable by theuser when the machine is in an appropriate state. In response todetecting one or more conditions, the safety system 240 willautomatically cause the test fixture 102 to go to a restricted state(e.g., a restricted setup state, disable all power and motion that couldpresent a hazardous condition, etc.).

As discussed in more detail below, the safety system 240 selectivelyadds, removes, increases, and/or decreases restrictions on operation ofthe material testing system based on monitoring input signals from thematerial testing system 100, input signals from the safety system 240,and/or control signals from the control processor 238. The safety system240 controls operation of the material testing system 100 by determininga state, from multiple predetermined states, in which the materialtesting system 100 is to be operated at any given time. Examplepredetermined states include one or more restricted states, in which oneor more operations of the material testing system 100 are restricted(e.g., disabled, limited, etc.) and one or more unrestricted states, inwhich the restrictions of the restricted states are reduced and/orremoved. In the example of FIG. 2 , the safety processor 240 attaches toand/or interrupts the control of the cross-member loader 234 and/or thefixture(s) 236 by the control processor 238. In some other examples, thesafety system 240 may directly control the cross-member loader 234and/or the fixture(s) 236 while enforcing any applicable restrictions onthe actuators.

Example restricted states include a setup state and a disabled state. Inthe setup state, the safety system 240 restricts one or more actuators(e.g., the motor 242 and/or the grip actuator(s) 246), and controls (orpermits control of) the actuators in response to operator inputs.Example restrictions on the motor 242 and/or the crosshead 244 mayinclude an upper speed limit, and/or an upper or lower position limit ofthe crosshead 244 relative to the test fixture 102. Example restrictionson the grip actuator(s) 246 may include an upper pressure limit and/oran upper grip force limit. In the disabled state, the safety system 240restricts the actuators and the control processor 238 does not controlthe actuator in response to operator inputs (e.g., does not attempt tocontrol the motor 242 and/or the grip actuator(s) 246, or is preventedfrom controlling the motor 242 and/or the grip actuator(s) 246 viade-energization).

Example unrestricted states include a caution state and a testing state.In the example caution state, the safety system 240 reduces restrictionson the actuator (e.g., motor 242 and/or the grip actuator(s) 246), anddoes not control the actuator(s) motor 242 and/or the grip actuator(s)246. In the caution state, the control processor 238 may control theactuator(s) to perform actions such as high speed jogging of thecrosshead 244 and/or increasing grip force by the pneumatic grips 248,for which the operator should not be physically proximate the crosshead244 and/or the pneumatic grips 248. In the example testing state, thesafety system 240 reduces restrictions on the actuator, while thecontrol processor 238 controls the actuator(s) to perform testing (e.g.,in accordance with a material testing procedure or program executed bythe control processor 238).

The example material testing system 100 of FIG. 2 may further includeone or more control panels 250, including multiple state indicators 252and one or more mode switches 254. The mode switches 254 may includebuttons, switches, and/or other input devices located on an operatorcontrol panel. For example, the mode switches 254 may include buttonsthat control the motor 242 to jog (e.g., position) the crosshead 244 ata particular position on the frame 228, switches (e.g., foot switches)that control the grip actuators 246 to close or open the pneumatic grips248, a mode control button that is depressed in conjunction with anotherbutton to enable the safety system 240 to permit operation in anunrestricted state, and/or any other input devices that could result inoperation in an unrestricted state.

The state indicators 252 correspond to a set of predetermined states(e.g., the disabled, setup, caution, and testing states described above)to which the safety system 240 can set the material testing system 100.As described in more detail below, the safety system 240 controls thestate indicators 252 to provide an indication as to the present state ofthe material testing system 100 as determined by the safety system 240.The state indicators 252 may include lights, displays, audio, mechanicalsystems, and/or any other indication that can be identified by theoperator.

FIG. 3 is a block diagram of an example implementation of the safetysystem 240 of FIG. 2 . As illustrated in FIG. 3 , the safety system 240includes a safety processor 302.

The example safety processor 302 includes multiple, redundant processingcores 304 a, 304 b. The processing cores 304 a, 304 b execute redundantinstructions 306 a, 306 b and receive redundant inputs, such that theprocessing cores 304 a, 304 b should, during normal operation of thetest fixture 102, produce substantially identical outputs. The safetyprocessor 302 (e.g., via the redundant cores 304 a, 304 b) monitors theplurality of inputs and determines the state of the material testingsystem 100 based on the inputs. The safety processor 302 may compareoutputs of the redundant instructions 306 a 306 b and control the stateof the material testing system 100 based on the comparison of theoutputs.

The example safety processor 302 and/or the redundant processing cores304 a, 304 b may be include general purpose central processing unit(CPU) from any manufacturer. In some other examples, the safetyprocessor 302 and/or the redundant processing cores 304 a, 304 b mayinclude one or more specialized processing units, such as RISCprocessors with an ARM core, graphic processing units, digital signalprocessors, and/or system-on-chips (SoC). The safety processor 302and/or the redundant processing cores 304 a, 304 b execute machinereadable instructions, such as the redundant instructions 306 a, 306 bthat may be stored locally at the processor (e.g., in an included cacheor SoC), in a storage device such as a random access memory, a read onlymemory, and/or a mass storage device.

The redundant processing cores 304 a, 304 b and the redundantinstructions 306 a, 306 b allow redundant and/or diverse inputs andoutputs to be processed by the safety system 240, which provides ahighly reliable and predictable system. Thus, while representativeinputs and outputs are illustrated in FIG. 3 , these inputs and/oroutputs may be duplicated to support the redundant processing cores 304a, 304 b and the redundant instructions 306 a, 306 b. The redundantinstructions 306 a, 306 b (e.g., embedded software, operating system,and generated code) execute by the safety processor 302 is compliantwith the processes outlined in international standards, including butnot limited to ISO 13849-1, which pertains to “Safety Related Parts ofControl Systems.” While the example safety processor 302 includesmultiple, redundant processing cores, in other examples the safetyprocessor 302 may include a single processing core, or multiple,non-redundant processing cores.

The safety system 240 of FIG. 3 further includes an actuator disablingcircuit 308 that selectively disables a power amplifier 310 fromproviding energy to the motor 242 of the crosshead 244. Additionally oralternatively, the actuator disabling circuit 308 (or another actuatordisabling circuit) may disable the grip actuator(s) 246 from providingenergy to the pneumatic grip(s) 248. The power amplifier 310 receivesinput power and outputs power to the motor 242 to control movement ofthe crosshead 244. The example actuator disabling circuit 308 and thepower amplifier 310 may be implemented using a safety rated Safe TorqueOff (STO) high-reliability servo power amplifier. The control processor238 may control the motor 242 and movement of the crosshead 244 via amotor control signal 312 to the power amplifier 310.

In response to an STO signal 314 from the safety processor 302, theactuator disabling circuit 308 disables the connected actuator (e.g.,the motor 242). For example, the actuator disabling circuit 308 maydisconnect all energy to the motor 242 (and/or other moving parts in thematerial testing system 100), in less than a certain defined period oftime. The example actuator disabling circuit 308 may provide an STOfeedback signal 315 to the safety processor 302, which indicates whetherthe actuator disabling circuit 308 is currently disabling the actuator.The safety processor 302 may compare the STO signal 314 to the STOfeedback signal 315 to detect faults.

In the example material testing system 100, the travel of the movingcrosshead 244 and any internal components is stopped after activation ofthe STO signal 314 as specified by international standards. Most of thesubsystems of the safety system 240 disclosed herein activate theactuator disabling circuit 308 to safely stop the machine. Additionally,the power amplifier 310 may include a motor braking circuit 316 todecelerate the motor 242 before applying the STO signal 314. The motorbraking circuit 316 allows the motor 242 to stop in a more controlledmanner by eliminating continued movement by mechanical inertia aftershutting down drive power. Using pre-disabling braking reduces orminimizes the motion of the crosshead 244 after the motor 242 isde-energized. Thus, the example actuator disabling circuit 308 and themotor braking circuit 316 provide a Category 1 stop as defined in theIEC 60204-1 standard, which is the “Electrical Safety Standard forMachinery.”

The example safety processor 302 monitors the motor 242 and/or the motorbraking circuit 316 while pre-disabling braking is occurring to confirmthat the motor 242 is braking. If the safety processor 302 determinesthat the motor 242 is not slowing down during the braking, then thesafety processor 302 performs a braking failure mitigation to cease thebraking and immediately de-energize the motor 242. By implementingbraking failure mitigation to the two-stage disabling sequence, thesafety processor 302 may shorten stopping distance in situations inwhich the braking is ineffective. While the shortest stopping distanceoccurs when the pre-disabling braking is operative, when thepre-disabling braking is not completely operative, then a two-stagesequence involving an inoperative pre-disabling braking can have alonger stopping distance than a single-stage sequence (e.g., onlydisconnection). A secondary advantage of braking failure mitigation isthat the mitigation enables more flexibility in implementing thetwo-stage disabling sequence, in that a wider range of components andsystems can be used for high-performance braking with a braking failuremitigation process that can catch failures with the braking system.

The example safety system 240 further includes an emergency stop 318(e.g., a button, a switch, etc.) that provides an emergency stop inputsignal 320 to the safety processor 302. The emergency stop 318 may be amanually operated emergency stop button, which is a complementary-typesafety function. The emergency stop 318 includes two channel redundancyfor signaling. The emergency stop 318 may include an emergency stopswitch 322, emergency stop detection circuits 324, and an actuatordisabling circuit 326. The emergency stop 318 is independentlycontrollable using the hardware and embedded software of the safetyprocessor 302. For example, in response to detecting the emergency stopinput signal 320 from the emergency stop detector 324, the safetyprocessor 302 sets the state of the material testing system 100 to thedisable state and provides an emergency stop output signal 321 to theemergency stop 318 (e.g., to the emergency stop switch 322).

The emergency stop switch 322, in response to the emergency stop outputsignal 321, controls the actuator disabling circuit 326 to control theactuator disabling circuit 314 and/or the motor braking circuit 314 tostop the motor 242. The example actuator disabling circuit 326 may havea first connection to the motor braking circuit 314, and secondredundant connections to the actuator disabling circuit 308. When theactuator disabling circuit 326 is triggered, the actuator disablingcircuit 326 activates the motor braking circuit 314, delays for a timeto permit the braking to occur, and then activates the actuatordisabling circuit 308 to de-energize the applicable actuator.

In addition or as an alternative to control via the safety processor302, the emergency stop switch 322 may directly actuate the actuatordisabling circuit 308 within the power amplifier 310, such as byphysical interruption of the STO signal 314 between the safety processor302 and the actuator disabling circuit 308. The safety processor 302monitors the emergency stop detection circuits 324 and acts as aredundant monitor to the hardware. The safety processor 302 outputs theSTO signal 314 to control the actuator disabling circuit 308 to continueto disable the motor 242 so that, when the emergency stop switch 322 isreleased, the material testing system 100 will remain disabled (e.g., ina restricted state) and require user interaction to re-enable operationof the motor 242.

The example material testing system 100 (e.g., the test fixture 102) iscompatible with interlock guarding systems with redundant or diversecontacts. The example safety system 240 may include one or more guards328 and guard interlocks 330 configured to provide physical and/orvirtual barriers to operator access to the material testing system 100while operating in an unrestricted state. For example, the guards 328may include physical barriers that are opened and closed to controlaccess to the volume around the pneumatic grips 248 and/or the crosshead244 (and/or other moving components). Example physical barriers includeguard doors, which may use redundant safety switches to monitor whetherthe doors guarding the protected volume are open or closed. Each doorswitch has mechanically linked normally open and normally closedcontacts, which may be dynamically pulsed (e.g., by the guard interlocks330) and/or otherwise received as inputs. Pulsing permits plausibilitydiagnostic checking of the guard door switches in real time.

Additionally or alternatively, the guards 328 may include virtual guardsthat monitor the volume around the pneumatic grips 248 and/or thecrosshead 244 for intrusion into the volume. Example virtual guards mayinclude light curtains, proximity sensors, and/or pressure pads. Whilevirtual guarding does not physically prevent access, the virtualguarding outputs guarding signals to the guard interlocks 330, whichoutput interlock signals 332 to the safety processor 302 and/or actuatordisabling circuit 308 (e.g., similar to the emergency stop switch 322discussed above).

The interlocks 330 may trigger the actuator disabling circuit 308 tode-energize the motor 242. In some examples, the safety processor 302controls re-enabling of the power amplifier 310 when the guardinterlocks 330 are no longer triggered, in a similar manner as theemergency stop switch 322 discussed above.

Additionally or alternatively, the example safety system 240 may defaultto a restricted “setup” state when an operator enters the protectedvolume of the material testing system 100. Instead of disabling orde-energizing actuators of the system 100, the setup state enforcesrestrictions on speed, pressure, or other activities.

The example safety system 240 includes multiple state indicators 252 andmode switches 254. The example safety processor 302 monitors the modeswitches 254 by, for example, dynamically pulsing the mode switches 254to generate or obtain mode switch input signals 338 (e.g., one or moremode switch inputs for each of the mode switches 254). In some examples,the mode switches 254 are high-reliability switches. The safetyprocessor 302 may test the mode switches 254 for short circuits or otherfaulty conditions periodically, aperiodically, in response to events(e.g., at startup of the material testing machine), on a predeterminedschedule, and/or at any other times.

The example safety processor 302 controls the state indicators 252 toindicate the state of the material testing system 100 to the operator.For example, the safety processor 302 may output indicator signals 342to the state indicators 252. If the state indicators 252 are lights, theoutput indicator signals 342 may, for example, control each of thelights to be on, off, flashing, and/or any other output for the lights.In some examples, the safety processor 302 determines the conditions ofthe indicators via indicator feedback signals 340. Example indicatorfeedback signals 340 may indicate to the safety processor 302 whethereach of the state indicators 252 is on, off, short-circuited,open-circuited, and/or any other status or condition of the stateindicators 252. If the processor determines that one or more of thestate indicators 252 are not in the commanded proper state, the safetyprocessor 302 controls the material testing system to be in a restrictedstate provides a notification to the operator (e.g., via the controlpanel 250 or other notification).

The safety system 240 includes a power supply monitor 344 to monitor thepower supplies (e.g., DC and AC power supplies) that provide power tocomponents of the material testing system 100. The power supply monitor344 provides one or more power supply status signals 346 to the safetyprocessor 302 and/or to the watchdog circuit 362 (described below) toindicate whether the monitored power supplies are within respectivevoltage and/or current ranges. If the power supply monitor 344determines that one or more of the power supplies are out of tolerance,the safety processor 302 and/or to the watchdog circuit 362 may disablethe material testing system 100 and alert the operator.

The example safety system 240 further includes one or more speedsensor(s) 348. The example speed sensor(s) 348 may be integrated,redundant, and/or diverse speed monitoring sensors. The speed sensor(s)348 provide speed signal(s) 350, which are representative of thecrosshead speed, to the safety processor 302. The safety processor 302monitors the speed signal(s) 350 to ensure the crosshead 244 does notexceed an upper speed limit (e.g., crosshead travel limit(s) 352) asdetermined by the current operating mode of the machine. For example,the value of the upper speed limit may depend on whether the materialtesting system 100 is in a restricted state or an unrestricted state. Insome examples, two speed sensors that operate on different principlesmay be used in the material testing system 100 to prevent the sensors348 from sustaining common cause failures. The speed signal 350 of eachspeed sensor 348 is read and compared by the safety processor 302 toverify that the speed signals 350 are in agreement. If one speed sensor348 indicates a different speed than another speed sensor 350, thesafety processor 302 disables the material testing system 100 (e.g., viathe actuator disabling circuit 308).

The example crosshead travel limit(s) 352 may include a travel limitthat specifies a limit on the position of the crosshead 244. When thecrosshead travel limit(s) 352 is reached, the safety processor 302 stopsthe motion of the crosshead 244. In some examples, the crosshead travellimit(s) 352 are multi-level limits, where the number of limits that aretriggered indicate how far the crosshead travel limit(s) 352 have beenexceeded. In some examples, a first level limit is handled by the safetyprocessor 302 to stop operation of the applicable actuator (or allactuators), such as the motor 242. As the crosshead 244 continues tomove beyond the first level limit and hits a second level limit (e.g.,farther outside of the acceptable range than the first level limit), thecrosshead travel limit 352 may trigger a direct connection (e.g., ahardware connection) to the actuator disabling circuit 308 and/or themotor braking circuitry 316, and/or to the actuator disabling circuit326, to trigger the two phase disabling of the motor 242.

In some examples in which the material testing system 100 includesautomatic gripping (e.g., pneumatically powered grips, hydraulicallypowered grips, electrically powered grips, electromechanically poweredgrips, electromagnetically powered grips, etc.), the safety system 240includes a grip controller 354 that controls the grip actuatorsaccording to a multi-pressure gripping scheme. The multi-pressuregripping scheme reduces (e.g., minimizes, eliminates) the risk of injuryto an operator when installing material test specimens in the materialtesting system 100 the pneumatic grips 248.

When the safety processor 302 is controlling the material testing system100 in the setup state, the safety processor 302 provides a pressuresignal 356 to the grip controller 354. The grip controller 354 controlsthe upper limit on the pressure that may be applied via the grips 248 bycontrolling the grip actuator(s) 246. The pressure signal 356 (which maybe directly proportional to specimen gripping force) is limited to allowenough pressure to grip the specimen via the grips 248, but not enoughpressure to cause severe injury to the operator. Conversely, when thesafety processor 302 is controlling the material testing system 100 inthe caution or testing states, the safety processor 202 provides thepressure signal 356 to cause the grip controller 354 to enable thehigher pressure used to grip test specimens during testing. The examplegrip controller 354 may monitor the main system pressure (e.g., viapressure sensor(s) 358) and/or the pressure(s) in the pneumatic grip(s)248 (e.g., upper and lower grips). The grip controller 354 feeds thepressure signals 360 to the safety processor 302 to verify that thecommanded pressures are being enforced.

In some examples, the grip controller 354 is controlled via an operatorinput using a foot pedal switch. For example, the foot pedal switch mayinclude separate switches to apply pressure and to release pressure viathe pneumatic grip(s) 248. The switches may be mechanically linkedswitches, which may be dynamically pulsed to check for plausibilitybetween the switches and/or to monitor for potential faults in theswitches (e.g., electrical faults).

The safety processor 302 further controls the grip controller 354 tode-energize the grip actuator(s) 246 when power is disabled to thematerial testing system 100. For example, the safety processor 302 maycontrol the grip actuator(s) 246 (e.g., via one or more valves, relays,etc.) to enable pressurization when powered, but to be normallydepressurized for pneumatic actuators such that the pneumatic grip(s)248 are prevented from applying grip force when the material testingsystem 100 is unpowered.

The example safety system 240 further includes a watchdog circuit 362.The watchdog circuit 362 communicates with the safety processor 302periodically, aperiodically, in response to one or more events ortriggers, and/or at any other time to verify the operation of the safetyprocessor 302. For example, the safety processor 302 may communicate aheartbeat signal, or a response to a challenge from the watchdog circuit362, to indicate to the watchdog circuit 362 that the safety system 240is operating properly. If the watchdog circuit 362 does not receive anexpected signal from the safety processor 302, the watchdog circuit 362disables the material testing system 100 and notifies the operator.

The example safety processor 302, the example emergency stop 322, theexample guard interlock 330, the example crosshead travel limit(s) 352,and/or the example watchdog circuit 362 are coupled (e.g., connected viahardware) to the actuator disabling circuit 326. When any of the safetyprocessor 302, the emergency stop 322, the guard interlock 330, thecrosshead travel limit(s) 352, and/or the watchdog circuit 362 determinethat a respective condition is satisfied so as to disable the materialtesting system 100 (e.g., activation of the emergency stop switch 322,tripping of the guard 328, exceeding a crosshead travel limit 352,and/or triggering of the watchdog circuit 362), the actuator disablingcircuit 326 is used to activate the motor braking circuit 316 and theactuator disabling circuit 308. The safety processor 302 may determinethat the state of the material testing system 100 is the disabled state.

While the example control processor 238 and the safety processor 302 areillustrated as separate processors, in other examples the controlprocessor 238 and the safety processor 302 may be combined into a singleprocessor or set of processors that are not divided into control andsafety functions. Furthermore, the control processor 238, the safetyprocessor 302, and/or combined processors may include non-processingcircuitry, such as analog and/or digital circuitry to perform one ormore specialized functions.

The present methods and systems may be realized in hardware, software,and/or a combination of hardware and software. The present methodsand/or systems may be realized in a centralized fashion in at least onecomputing system, or in a distributed fashion where different elementsare spread across several interconnected computing systems. Any kind ofcomputing system or other apparatus adapted for carrying out the methodsdescribed herein is suited. A typical combination of hardware andsoftware may include a general-purpose computing system with a programor other code that, when being loaded and executed, controls thecomputing system such that it carries out the methods described herein.Another typical implementation may comprise an application specificintegrated circuit or chip. Some implementations may comprise anon-transitory machine-readable (e.g., computer readable) medium (e.g.,FLASH drive, optical disk, magnetic storage disk, or the like) havingstored thereon one or more lines of code executable by a machine,thereby causing the machine to perform processes as described herein. Asused herein, the term “non-transitory machine-readable medium” isdefined to include all types of machine readable storage media and toexclude propagating signals.

As utilized herein the terms “circuits” and “circuitry” refer tophysical electronic components (i.e. hardware) and any software and/orfirmware (“code”) which may configure the hardware, be executed by thehardware, and or otherwise be associated with the hardware. As usedherein, for example, a particular processor and memory may comprise afirst “circuit” when executing a first one or more lines of code and maycomprise a second “circuit” when executing a second one or more lines ofcode. As utilized herein, “and/or” means any one or more of the items inthe list joined by “and/or”. As an example, “x and/or y” means anyelement of the three-element set {(x), (y), (x, y)}. In other words, “xand/or y” means “one or both of x and y”. As another example, “x, y,and/or z” means any element of the seven-element set {(x), (y), (z), (x,y), (x, z), (y, z), (x, y, z)}. In other words, “x, y and/or z” means“one or more of x, y and z”. As utilized herein, the term “exemplary”means serving as a non-limiting example, instance, or illustration. Asutilized herein, the terms “e.g.,” and “for example” set off lists ofone or more non-limiting examples, instances, or illustrations. Asutilized herein, circuitry is “operable” to perform a function wheneverthe circuitry comprises the necessary hardware and code (if any isnecessary) to perform the function, regardless of whether performance ofthe function is disabled or not enabled (e.g., by a user-configurablesetting, factory trim, etc.).

While the present method and/or system has been described with referenceto certain implementations, it will be understood by those skilled inthe art that various changes may be made and equivalents may besubstituted without departing from the scope of the present methodand/or system. For example, block and/or components of disclosedexamples may be combined, divided, re-arranged, and/or otherwisemodified. In addition, many modifications may be made to adapt aparticular situation or material to the teachings of the presentdisclosure without departing from its scope. Therefore, the presentmethod and/or system are not limited to the particular implementationsdisclosed. Instead, the present method and/or system will include allimplementations falling within the scope of the appended claims, bothliterally and under the doctrine of equivalents.

What is claimed is:
 1. A material testing system, comprising: a firstactuator configured to control an operator-accessible component of thematerial testing system, wherein the operator-accessible componentcomprises an automatic grip or a manual grip configured to grip amaterial under test, wherein the actuator is configured to actuate theautomatic grip or the manual grip; a crosshead configured to move theautomatic grip or the manual grip to position the automatic grip or themanual grip or apply force to the material under test held by theautomatic grip or the manual grip; a second actuator configured toactuate the crosshead; an actuator disabling circuit configured todisable the second actuator; and one or more processors configured to:control the second actuator based on a material testing process; monitora plurality of inputs associated with operation of the material testingsystem; determine, based on the plurality of inputs and the materialtesting process, a state of the material testing system from a pluralityof predetermined states, the predetermined states comprising one or moreunrestricted states and one or more restricted states, wherein the oneor more processors are configured to restrict at least one operation ofthe material testing system in the one or more restricted states, andthe one or more processors are configured to reduce or remove at leastone restriction of the one or more restricted states in the one or moreunrestricted states; control the actuator disabling circuit based on thedetermined state; when the state of the material testing system is oneof the one or more restricted states, limit a grip pressure produced bythe first actuator to less than a threshold pressure and limit acrosshead speed generated by the second actuator to less than athreshold speed; when the state of the material testing system is one ofthe one or more unrestricted states, permit the grip pressure producedby the first actuator to exceed the threshold pressure and permit thecrosshead speed generated by the second actuator to exceed a thresholdspeed.
 2. The material testing system as defined in claim 1, wherein theone or more processors comprise a safety processor having a plurality ofprocessing cores configured to: execute redundant code to monitor theplurality of inputs and to determine the state of the material testingsystem; and compare outputs of the redundant code, wherein at least oneof the control of the actuator disabling circuit or control of a stateoutput indicator is based on the comparison of the outputs.
 3. Thematerial testing system as defined in claim 1, wherein the plurality ofinputs comprises a guarding input configured to indicate whether anoperator is within a predetermined volume around the material testingsystem, and the one or more processors are configured to set the stateof the material testing system in response to determining that theoperator is within the predetermined volume.
 4. The material testingsystem as defined in claim 3, further comprising at least one of amechanically interlocked guard door or a light curtain, configured tooutput the guarding input.
 5. The material testing system as defined inclaim 3, wherein the one or more processors are configured to limit aspeed of the second actuator in response to the guarding input.
 6. Thematerial testing system as defined in claim 1, further comprising aplurality of speed sensors configured to monitor a speed of thecrosshead, the one or more processors configured to: compare speedsdetected by the speed sensors; and when the compared speeds have morethan a threshold difference, at least one of: a) set the state of thematerial testing system or b) disable operation of the material testingsystem.
 7. The material testing system as defined in claim 1, whereinthe plurality of inputs comprises an emergency stop input coupled to atleast one of the one or more processors or the actuator disablingcircuit, wherein at least one of the one or more processors or theemergency stop input is configured to control the actuator disablingcircuit to disconnect the second actuator from the source of energy forthe second actuator.
 8. The material testing system as defined in claim7, wherein the one or more processors are configured to control theactuator disabling circuitry to continue disconnection of the actuatorfrom the source of energy after the emergency stop input is releaseduntil the one or more processors identify a user interaction toreconnect the second actuator to the source of energy.
 9. The materialtesting system as defined in claim 1, further comprising a power supplymonitor circuit configured to monitor a power supply of the materialtesting system, wherein the one or more processors are configured to atleast one of set the state of the material testing system or disableoperation of the material testing system in response to a signal fromthe power supply monitor circuit indicating that the power supply is outof tolerance.
 10. The material testing system as defined in claim 2,wherein the state output indicator comprises at least one of a pluralityof lights corresponding to the one or more unrestricted states and theone or more restricted states, or a display configured to displayinformation about the material testing system.
 11. The material testingsystem as defined in claim 10, wherein the one or more processors areconfigured to: monitor the state output indicator; and at least one ofset the state of the material testing system or disable operation of thematerial testing system in response to detecting that the state outputindicator is not outputting a state corresponding to the determinedstate.
 12. The material testing system as defined in claim 1, whereinthe one or more unrestricted states comprise: a caution state in whichthe one or more processors are reducing restrictions on the firstactuator or the second actuator and are not controlling the firstactuator or the second actuator to perform testing; and a testing statein which the one or more processors are reducing restrictions on thefirst actuator or the second actuator and are controlling the firstactuator or the second actuator to perform testing.
 13. The materialtesting system as defined in claim 1, wherein the one or more restrictedstates comprise: a setup state in which the one or more processors arerestricting the first actuator or the second actuator and controllingthe first actuator or the second actuator in response to operatorinputs; and a disabled state in which the one or more processors arerestricting the first actuator or the second actuator and do not controlthe first actuator or the second actuator in response to operatorinputs.
 14. The material testing system as defined in claim 1, whereinthe first actuator or the second actuator comprises at least one of anelectric motor, a pneumatic actuator, a hydraulic actuator, apiezoelectric actuator, a relay, or a switch.
 15. The material testingsystem as defined in claim 1, wherein the one or more processorscomprise: a control processor configured to perform the control of thefirst actuator or the second actuator; and one or more safety processorsconfigured to perform the monitoring of the plurality of inputs, thedetermining of the state of the material testing system, and thecontrolling of the actuator disabling circuit.
 16. A material testingsystem, comprising: an actuator configured to control anoperator-accessible component of the material testing system; anactuator disabling circuit configured to disable the actuator; one ormore processors configured to: control the actuator based on a materialtesting process; monitor a plurality of inputs associated with operationof the material testing system; determine, based on the plurality ofinputs and the material testing process, a state of the material testingsystem from a plurality of predetermined states, the predeterminedstates comprising one or more unrestricted states and one or morerestricted states, wherein the one or more processors are configured torestrict at least one operation of the actuator in the one or morerestricted states, and the one or more processors are configured toreduce or remove at least one restriction of the at least one operationof the actuator in the one or more restricted states while in the one ormore unrestricted states; and control the actuator disabling circuitbased on the determined state; and an actuator braking circuitconfigured to, in response to a signal to disconnect the actuator from asource of energy, decelerate the actuator prior to the disconnection.17. The material testing system as defined in claim 16, wherein the oneor more processors are configured to: determine whether the actuator isdecelerating by at least a threshold deceleration; and in response todetermining that the actuator is not decelerating by at least thethreshold deceleration, disconnect the actuator.